GET virustotal.com HTTP 200583 ms29.7 KB$0.000208 captured Aug 7, 2026
virustotal.com, as data
One API turns any virustotal.com page into markdown, structured JSON, its link graph or a screenshot, and crawls the whole site the same way. The panel shows the real response we captured.
- Render mode
- Plain HTTP, no browser needed
- Response
- HTTP 200 in 583 ms
- Page size
- 29.7 KB of markdown, 800 lines
- Fields
- Business Name, Address, Phone, Category and 1 more
- Captured
- Aug 7, 2026
Free balance on signup, no card. This virustotal.com page cost $0.000208 to fetch.
It's important to highlight that “tag” is one of the few modifiers supporting wildcards.Many of you asked about language specific document searches during our Threat Hunting with VirusTotal session. The “lang:” keyword uses Exif language property to find files matching any language:## Non-Windows samplesWe have dedicated keywords to perform searches for platforms such as Android, MacOS or even Symbian.For Android, which is one of the most popular non-Windows platforms by number of malware samples, we use Androguard to process all ingested samples. You can query for any Androguard output which is stored under the umbrella “androguard:” keyword:This includes all sorts of different types of processed data: code strings, manifest entities, certificate signatures, etc. For example, this example looks for APKs that mimic a legitimate app by using the same icon (“main_icon_dhash”), but signed with a different certificate:main_icon_dhash:9ef2e0c8e8f8bc8e type:apk AND NOT androguard:"45989dc9ad8728c2aa9a82fa55503e34a8879374"However when looking for something specific it is better using “androguard_package:” to search for APKs with explicit package names (please note this only works for newly indexed files since March 2022):androguard_package:org.xmlpush.v3Since this is a new search modifier, please feel free to share our feedback with us.In some cases you can skip using any special keyword and build your query using APK internal paths only:( "assets/s.bin" AND "assets/l.bin" ) OR ( "assets/s.bin" AND "assets/m.bin" ) OR ( "assets/m.bin" AND "assets/c.bin" )%20OR%20(%20%22assets%2Fs.bin%22%20AND%20%22assets%2Fm.bin%22%20)%20OR%20(%20%22assets%2Fm.bin%22%20AND%20%22assets%2Fc.bin%22%20)/files)Here are some more examples for different platforms.tag:iphone tag:signed p:5+ - signed iOS app packages detected by at least 5 AVs.What Spider does on virustotal.com
Same key, five endpoints. The numbers under a cell were measured on this page.
Page to markdown
Clean text for RAG and LLM context, boilerplate removed. The lane that runs without a key.
583 ms · $0.000208Page to JSON
Spider reads the page and names the fields. Pass your own schema when you need exact keys.
Rendered capture
Real Chromium, full-page PNG. The same call also returns the rendered HTML.
The call behind the panel
This request produced the response above. Paste it with your key and you get the same bytes.
curl -X POST https://api.spider.cloud/scrape \
-H "Authorization: Bearer $SPIDER_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "https://blog.virustotal.com/2022/12/vt-intelligence-cheat-sheet.html", "return_format": "markdown"}'from spider import Spider
app = Spider()
params = {"return_format": "markdown"}
page = app.scrape_url("https://blog.virustotal.com/2022/12/vt-intelligence-cheat-sheet.html", params=params)
print(page[0]["content"])import { Spider } from "@spider-cloud/spider-client";
const app = new Spider();
const [page] = await app.scrapeUrl("https://blog.virustotal.com/2022/12/vt-intelligence-cheat-sheet.html", {
return_format: "markdown",
});
console.log(page.content);What virustotal.com costs
Multiplied from the measured 29.7 KB page. Estimates round to the cent.
1 GB of transfer costs $1, plus $0.001 per CPU minute, and failed requests cost $0. Crawling daily? The Unlimited plan is a flat monthly rate.
Point this at the rest of virustotal.com.
The capture above took 583 ms and cost $0.000208. The same call takes any URL on virustotal.com.